Posted by Joachim Rütter on Oct 24 Hello, jxrlib, Microsoft's JPEG XR library (abandoned upstream), has memory bugs that a damaged JPEG XR file of a few hundred bytes triggers, including a heap buffer overflow write. All of them are fixed in public in the maintained fork github.com/mircomir/jxrlib (1.4.4, released 2026-10-09), but most distributions still ship older code. I found them while fuzzing the decoders in my image viewer, Featherview.
jxrlib: memory bugs on damaged JPEG XR files, fixed in mircomir/jxrlib 1.4.4, still in most distributions
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/368
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security
Table Of ContentsTable of ContentsDefenderKiller Exploits a Legacy Microsoft DriverImplications for Endpoint SecurityIndicators of Compromise and Technical ArtifactsStay…
The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603
Executive summary In 2025, several threat actors exploited CVE-2025-53770 and CVE-2025-53771 (ToolShell vulnerabilities) in on-premises Microsoft SharePoint to achieve…
When File Ingestion Misleads Language Models: Measuring and Mitigating Divergences in Office Documents
arXiv:2611.05806v1 Announce Type: new Abstract: Office documents are now routinely uploaded to large language models (LLMs) for processing. However, an LLM does not…
PIMROP: A Feasibility Study of Return-Oriented Programming on Commercial Processing-in-Memory Architectures
arXiv:2611.06036v1 Announce Type: new Abstract: Processing-in-Memory places small programmable cores on the memory device, where they execute beside the DRAM banks and…
CVE-2026-59268: Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader
Posted by Arrigo Marchiori on Nov 03 Severity: important Affected versions: - Apache OpenOffice through 4.1.16 Description: An out-of-bounds Write vulnerability in…
Microsoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms
Microsoft has been named a Leader in the inaugural 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms. We believe this recognition reflects Microsoft’s…